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Abstract 

This paper establishes inner bounds on the secrecy capacity regions for the general 3-receiver broadcast channel 
with one common and one confidential message sets. We consider two setups. The first is when the confidential 
message is to be sent to two receivers and kept secret from the third receiver. Achievability is established using 
indirect decoding, Wyner wiretap channel coding, and the new idea of generating secrecy from a publicly available 
superposition codebook. The inner bound is shown to be tight for a class of reversely degraded broadcast channels 
and when both legitimate receivers are less noisy than the third receiver. The second setup investigated in this paper is 
when the confidential message is to be sent to one receiver and kept secret from the other two receivers. Achievability 
in this case follows from Wyner wiretap channel coding and indirect decoding. This inner bound is also shown to be 
tight for several special cases. 



I. Introduction 

The wiretap channel was first introduced in the seminal paper by Wyner [1]. He considered a 2-receiver broadcast 
channel where sender X wishes to communicate a message to receiver Y while keeping it secret from the other 
receiver (eavesdropper) Z. Wyner showed that the secrecy capacity when the channel to the eavesdropper is a 
degraded version of the channel to the legitimate receiver is 

Cs = max(/(X; Y) - I{X; Z)). 

p(x) 

The main coding idea is to randomly generate 2"'^^'^^-^^^ x" sequences and partition them into 2"^ message bins, 
where R < I{X; Y) — I{X; Z). To send a message, a sequence from the message bin is randomly selected and 
transmitted. The legitimate receiver uniquely decodes the codeword and hence the message with high probability, 
while the message is kept asymptotically secret from the eavesdropper provided R < Cs- 

This result was extended by Csiszar and Korner [2] to general (non-degraded) 2-receiver broadcast channels with 
common and confidential messages. They established the secrecy capacity region, which is the optimal tradeoff 
between the common and private message rates and the eavesdropper's private message equivocation rate. In the 
special case of no common message, their result yields the secrecy capacity for the general wiretap channel, 

a= iiiax (I{V;Y)^I{V;Z)). 

p{v)p{x\v) 

The achievability idea is to use Wyner's wiretap channel coding for the channel from y to F by randomly 
selecting a codeword from the message bin and then sending a random sequence X" generated according 
to 117=1 Px\v{xi\vi). 

The work in [2] has been extended in several directions by considering different message demands and secrecy 
scenarios, e.g., see [3], [4]. However, with some notable exceptions such as [5] and [6], extending the result of Csiszar 
and Korner to general discrete memoryless broadcast channels with more than two receivers has remained open, since 
even the capacity region without secrecy constraints for the 3-receiver broadcast channel with degraded message 
sets is not known in general. The secrecy setup for the 3-receiver broadcast channel also has close connections 
to the compound wiretap channel model (see [7, Chapter 3] and references therein). Recently, Nair and El Gamal 
[8] showed that the straightforward extension of the Korner-Marton capacity region for the 2-receiver broadcast 



channel with degraded message sets to more than 3 receivers is not optimal. They established an achievable rate 
region for the general 3-receiver broadcast channel and showed that it can be strictly larger than the straightforward 
extension of the Korner-Marton region. 

In this paper, which is a much expanded version of [9], we establish inner and outer bounds on the secrecy 
capacity region for the 3-receivers broadcast channel with common and confidential messages. We consider two 
setups. 

• 2-receiver, 1 -eavesdropper. Here the confidential message is to be sent to two receivers and kept secret from 
the third receiver (eavesdropper). 

• 1 -receiver, 2-eavesdroppers: In this setup the confidential message is to be sent to one receiver and kept secret 
from the other two receivers. 

To illustrate the main coding idea in our new inner bound for the 2-receiver, 1 -eavesdropper setup, consider the 
special case where a message M 6 [1 : 2"^] is to be sent reliably to receivers Yi and Y2 and kept asymptotically 
secret from eavesdropper Z. A straightforward extension of the Csiszar-Korner [2] result for the 2-receiver wiretap 
channel yields the lower bound on the secrecy capacity 

Cs> max Tmxi{I{V;Yi)-I{V;Z),I{V;Y2)-I{V-Z)}. (1) 

p{v)p{x\v) 

Now, suppose Z is a degraded version of Yi , then from Wyner's wiretap result, we know that {I{V;Yi)~I{V; Z)) < 
{I{X; Yi) — I{X; Z)) for all p{v^ x). However, no such inequality holds in general for the second term under the 
minimum. As a special case of the inner bound in Theorem 1, we show that the rate obtained by replacing V by 
X only in the first term in (1) is achievable, that is, we establish the lower bound 

Cs> max mm{I{X-Yi)~I{X-Z),I{V-Y2)~I{y-Z)}. (2) 

p{v)p[x\v) 

To prove achievability of (2), we again randomly generate 2"(^'^^'^^)~'') sequences and partition them into 
2nR i^jjjs^ where R = {I{V] Y2) — I{V; Z)). For each i;" sequence, we randomly and conditionally independently 
generate 2"^('^'-^l^) a;" sequences. The w" and sequences are revealed to all parties, including the eavesdropper. 
To send a message m, the encoder randomly chooses a sequence from bin m. It then randomly chooses an 
sequence from the codebook for the selected sequence (instead of randomly generating an X" sequence as 
in the Csiszar-Korner scheme) and transmits it. Receiver Y2 decodes directly, while receiver Yi decodes 
indirectly through [8]. In Section III, we show through an example that this new lower bound can be strictly 
larger than the extended Csiszar-Korner lower bound. We then show in Theorem 1 that this lower bound can be 
generalized further via Marton coding. 

The rest of the paper is organized as follows. In the next section we present needed definitions. In Section III, we 
provide an alternative proof of achievability for the Csiszar-Korner 2-receiver wiretap channel that uses superposition 
coding and random codeword selection instead of random generating of the transmitted codeword. This technique 
is used in subsequent sections to establish the new inner bounds for the 3-receiver setups. In Section IV, we present 
the inner bound for the 2-receiver, 1 -eavesdropper case. We show that this lower bound is tight for the reversely 
degraded product broadcast channel and when the eavesdropper is less noisy than both legitimate receivers. In 
Section V, we present inner and outer bounds for the 1 -receiver, 2-eavesdropper setup for 3-receiver multilevel 
broadcast channel [10]. We show that the bounds coincide in several special cases. 

II. Definitions and Problem Setup 

Consider a 3-receiver discrete memoryless broadcast channel with input alphabet X, output alphabets 3^i, 3^2, 3^3 
and conditional pmfs p{yi,y2,ya\x)- We investigate the following two setups. 

A. 2-Receivers, 1 -Eavesdropper 

Here the confidential message is to be sent to receivers Yi and Y2 and is to be kept secret from the eavesdropper 
Y^ = Z). A (2"-'^" , 2"^% n) code for this scenario consists of: (i) two messages (A/o,A/i) uniformly distributed 
over [1 : 2"-""] x [1 : 2"-"i] ; (ii) an encoder that randomly generates a codeword X"(mo,mi) according to the 
conditional pmf p{x^\mQ,mi); and (iii) 3 decoders; the first decoder assigns to each received sequence an 
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estimate (Moi,Afii) e [1 : 2"^"] x [1 : 2"^^] or an error message, the second decoder assigns to each received 
sequence 1/2 an estimate {Mm, M12) G [1 : 2"^°] x [1 : 2"^^] or an error message, and the third decoder assigns 
to each received sequence an estimate M03 € [1 : 2"^°] or an error message. The probabihty of error for this 
scenario is defined as 

Pii") = P {Mo, ^ Afofor J = 1, 2, 3or M,, ^ M.foi j = 1,2}. 

The equivocation rate at receiver Z, which measures the amount of uncertainty receiver Z has about message Mi, 
is defined as H(Afi|Z")/n. 

A secrecy rate tuple {Rq, i?e) is said to be achievable if 

lim P^l'^ = 0, and 
liminf-i/(i\/i|Z") > Re. 

n— >-oo Tl 

The secrecy capacity region is the closure of the set of achievable rate tuples (i?o, Ri,Re)- 
For this setup, we also consider the special case of asymptotic perfect secrecy, where no common message is to 
be sent to Z and a confidential message, AI E [1 : 2"^], is to be sent to Yi and Y2 only. The probability of error 
is as defined above with Rq = Q and Ri ~ R. A secrecy rate R is said to be achievable if there exists a sequence 
of (2"^ , n) codes such that 

lim P^^^ = 0, and 
liminf-i/(A/|Z") > R. 

n— >oo Tl 

The secrecy capacity, C5, is the supremum of all achievable rates. 

B. 1 -Receiver, 2-Eavesdroppers 

In this setup, the confidential message is to be sent to receiver Yi and kept secret from eavesdroppers Y2 = Z2 and 
Yi = Z^. A (2"^" , 2"^^ , n) code consists of the same message sets and encoding function as in the 2-receiver, 1- 
eavesdropper case. The first decoder assigns to each received sequence y" an estimate (A/qi, Ah) G [1 : 2"^"] x [1 : 
2ri_Rij error message, the second decoder assigns to each received sequence ™ estimate A/02 G [1 : 2"^"] 

or an error message, and the third decoder assigns to each received sequence an estimate Afos G [1 : 2"''^"] or 
an error message. The probability of error is 

P^2^ = P{A/o, 7^ A/ofor J = 1, 2, 3or A\ AI,}. 

The equivocation rates at the two eavesdroppers are H{AIi\Z2)/n and H{AIi\Z^)/n, respectively. 
A secrecy rate tuple (Rq, Ri, Re2, Res) is said to be achievable if 

lim P^:^^ = 0, 
liminf ii/(A/i|Z") > R^,, j = 2,3. 

The secrecy capacity region is the closure of the set of achievable rate tuples {Rq, Ri, i?e2, Res)- For simplicity of 
presentation, we consider only the special class of multilevel broadcast channels [10]. 

III. 2-RECEIVER WIRETAP CHANNEL 

We first revisit the 2-receiver wiretap channel, where a confidential message is to be sent to the legitimate receiver 
Y and kept secret from the eavesdropper Z. The secrecy capacity for this case is a special case of the secrecy 
capacity region for the broadcast channel with common and confidential messages established in [2]. 

Proposition 1: The secrecy capacity of the 2-receiver wiretap channel is 

Cs=ma^(I{V-Y)-I{V;Z)). 

p{v,,x) 
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In the following, we provide a new proof of achievability for this result in which the second randomization step 
in the original proof is replaced by a random codeword selection from a public superposition codebook. As we 
will see, this proof technique allows us to use indirect decoding to establish new inner bounds for the 3-receiver 
wiretap channels. 

Proof of Achievability for Proposition 1: 

Fix p{v, x). Randomly and independently generate sequences v'^{lo), Iq G [1 : 2"^], each according to n"=i Pvivi). 
Partition the set [1 : 2"-^] into 2"-" bins B{m) ^ [{m - i)2"(«-«) + 1 : m2"(^-^)], m S [1 : 2"-"]. For each 
Zo G [1 : 2"^], randomly and conditionally independently generate sequences .t"(Zo,^i), G [1 : 2"^^], each 
according to n"=i-PA'|v(2;'i|^^i)- The codebook {{v" (Iq) , x" {Iq, li))} is revealed to all parties. To send the message 
m, an index Lq G B{m) is selected uniformly at random (as in Wyner's original proof). The encoder then randomly 
and independently selects an index Li and transmits x" {Lq, Li). Receiver Y decodes Lq by finding the unique 
index Iq such that (w"(fo),2/") G 7^'"'. By the law of large numbers and the packing lemma [11, Chapter 3], the 
average probability of error approaches zero as n — > oo if i? < {V; Y) — (5(e). 

We now show that I{M; Z"\C) < n5{e). Considering the mutual information between Z" and M, averaged over 
the random codebook C, we have 

I{M; Z"\C) = I{M, io, Li;Z''\C) - /(Lq, Li; Z"\M,C) 

(a) 

< I{X'';Z"\C) - H{La,Li\M,C) + H{La,Li\M,Z'',C) 

n 

< I{X,; Z,\C) - n{R - R) - nRi + H{Lo, Li\M, Z",C) 

i=l 

< nI{X-Z) - n{R + Ri - R) + H{Lo\M, Z",C) + H{Li\La, Z'\C). (3) 

(a) follows since {M, Lq, Li,C) — ?> X" — s> Z" from the discrete memoryless property of the channel. The last 
step follows from follows since H{Z,\C) < H{Z.,) = H{Z) and H{Z,\X,,C) = X;cP(c)p(2;<|c)iJ(Z|a:i,C) = 
Y.cPic)p{vi\c)H{Z\x^) = H{Z\X) It remains to upper bound H{Lo\M,Z'\C) and H{Li\Lo, Z'\C). By sym- 
metry of codebook construction, we have 

H{Lo\M,Z'\C) = 2-"^ H{Lo\M = m,Z",C) 

m— 1 

= H{Lo\Z",M ^l,C), 
if(ii|Lo,Z",C) = 2-"^^i7(Li|Lo = lo,Z",C) 

lo 

= H{Li\Lo = l,v"{l),Z",C). 
To further bound these terms, we use the following key lemma. 

Lemma L Let {U, V, Z) ~ p(u, v, z), S > and e > 0. Let [/" be a random sequence distributed according to 
Y[i=i Pu {ui) . Let I £ [1 : 2""^], be a set of random sequences that are conditionally independent given [/" 

and each distributed according to n"=i-Pv'|c/(''^i|''^i)' ^"'^ ^ = ^"(Ol- Let L £ [1 : 2"'^] be a random index 
with an arbitrary probability mass. Then, if P{(C/", Z") G T}""^} -I- 1 as n ^ oo and S* > I{V; Z\U)+S{e), 

there exists a 6'{e) > 0, where S'{e) — !> as e 0, such that, for n sufficiently large, 

H{L\Z",U'\C) < n{S-I{V;Z\U))+7i6'{e). 

The proof of this lemma is given in Appendix I. An illustration of the random sequence structure is given in 
Figure 1. 

Now, returning to (3), we note that P{{V{Lo), X'"{Lq, Li), Z") e tI"''} ^ 1 as n ^ cx) by law of large 
numbers. Hence, we can apply Lemma 1 to obtain 

H{Lo\Z'\M = l,C) < n{{R - R) - I{V; Z)) + nS{e), (4) 
H{Li\Lo = l,V",Z",C) < n{Ri-I{X;Z\V))+n6{e), (5) 
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Fig. 1: Structure of random sequences in Lemma 1. V^iV) is generated according to 0"=! Vv\uiyi\''J^i)- Solid arrows 
represent the sequence pair ([/", V^"(L), Z") while the dotted arrows to represent the other 1/" sequences jointly 
typical with the (f7", 2^") pair Lemma 1 gives an upper bound on the number of V^" sequences that can be jointly 
typical with a [V^Z^) pair. 



if i? - i? > /(y; Z) + (5(e) and i?i > I(X\ Z\V) + (5(e). Substituting from inequalities (4) and (5) into (3) shows 
that I{M\ Z" \C) < 2nS{e). We then recover the original asymptotic secrecy rate by noting that the constraint of 
^1 > Z\V) is not tight. This completes the proof of Proposition \. 

Remark 3.1: In the proof of Proposition 1 in [2], the encoder transmits a randomly generated codeword X" ~ 
]^"^j^pj5(:|v(xi|wi). Although replacing random X" generation by superposition coding and random codeword 
selection in our alternative proof does not increase the achievable secrecy rate for the 2-receiver wiretap channel, 
it can increase the rate when there are more than one legitimate receiver, as we show in the next sections. 

IV. 2-RECEIVERS, 1 -EAVESDROPPER WIRETAP CHANNEL 

We establish an inner bound on the secrecy capacity for the 3 -receiver wiretap channel with one common and 
one confidential message when the confidential message is to be sent to receivers Yi and Y2 and kept secret from 
receiver Z. In the following subsection, we consider the case where = and Mi = M e [I : 2"^] is to be 
kept asymptotically secret from Z. This result is then extended in Subsection IV-B to establish an inner bound on 
the secrecy capacity region. 

A. Asymptotic perfect secrecy 

We establish the following lower bound on secrecy capacity for the case where a confidential message is to be 
sent to receivers Yi and Y2 and kept secret from the eavesdropper Z. 

Theorem 1: The secrecy capacity of the 2-receiver, 1 -eavesdropper setup with one confidential message and 
asymptotic secrecy is lower bounded as follows 

Cs > mm{I{Vo , Vi; Yi\Q) ~ I {Vq,Vi; Z\Q), I {Vo,V2;Y2\Q) ~ I {Vo,V2; Z\Q)} 

forsomep((7, uo,'(;i,W2,a;) = p{q,vo)p{vi,V2\vo)p{x\vi,V2,vo) such that /(Vi, V2] Z\Vo) < I{Vi; Z\Vo)+I{V2; Z\Vo)- 
HVi;V2\Vo). 

In addition to superposition coding and the new coding idea discussed in the previous section. Theorem 1 also uses 
Marton coding [12]. 

For clarity, we first establish the following Corollary 1. 

Corollary 1: The secrecy capacity for the 2-receiver, 1 -eavesdropper with one confidential message and asymp- 
totic secrecy is lower bounded as follows 

Cs > ^ ^ max min{IiX;Y,\Q)-I{X;Z\Q),I(y;Y2\Q)-I(y;Z\Q)}. 

p{q)p{v\q)p{x\v) 



5 



Remark 4.1: Consider the case where X Yi ^ Z form a Markov chain. Then, we can show that Theorem 1 
reduces to Corollary 1, i.e., the achievable secrecy rate is not increased by using Marton coding when X ^ Z 

(OT X ^ Y2 ^ Z by symmetry) form a Markov chain. To see this, note that {I{X:Yi\Q) - I{X;Z\Q)) > 
{IiVi,Vo;Yi\Q) - I{Vi,Vo;Z\Q)) for all Vi if X ^ Yi ^ Z. Next, note that we can set V = (V"o,V^2) in 
Corollary 1 to obtain the rate in Theorem 1. 

Proof of Corollary 1: 

Codebook generation: Randomly and independently generate the time-sharing sequence according to HiLi PQili)- 
Next, randomly and conditionally independently generate 2"^ sequences w"(/o), G [1 : 2"^], each according 
to n"=i Pv|Q(''^i|'?i)- Partition the set [1 ; 2"^] into 2"^ equal size bins B{m), m G [1 : 2"-'^]. For each 
conditionally independently generate sequences x"'{Iq,Ii), G [1 : 2"^^], each according to n"=i -Pxivl^^il'f^ij- 
E'ncoiiOT^: To send a message to S [1 : 2"^], randomly and independently choose an index Lq € C(to) and an 
index Li G [1 : T'^^], and send a;"(Lo,Li). 

Decoding: Assume without loss of generality that Lq = \ and m = 1. Receiver Y2 finds Lq, and hence m, via 
joint typicality decoding. By the law of large number and the packing lemma, the probability of error approaches 
zero as n — > 00 if 

R<I{y-Y2\Q)^5{e). 

Receiver Yi finds Lq (and hence to) via indirect decoding. That is, it declares that Lq is sent if it is the unique 
index such that (g", w"(Lo), a-"(Lo, ^1), G T}""^ for some Zi G [1 : 2"^^]. To analyze the average probabiUty 
of error P(5), define the error events 

£-io-{(Q",X"(l,l),Yi")^r,(")}, 
£11 = {(Q",X"(;o,^i),yi") e Ti^'^'for some ^ 1}. 
Then, by union of events bound the probability of error is upper bounded as 

P(^) <P{fio} + P{Ai}. 
Now by law of large numbers, P{£io} — > as n 00. Next consider 

p{fii} < p{(Q",y"(Zo),^"(^o, G 

^ 2n{R+Ri-I{y,X-Yi\Q)+S(e)) 

Hence, Pjfn} ^ as n ^ 00 if 

R + Ri< I{X;Yi\Q)-S{e). 

Analysis of equivocation rate: To bound the equivocation rate term H{M\Z",C), we proceed as before and show 
that the I{M; Z"|C) < 2nS{e). Note that the only difference between this case and the analysis for the 2-receiver 
case in Section II is the addition of the time-sharing random variable Q. Since 

P{(Q", V"{La), X"(io, Li), Z") G TJ""^} ^ 1 as n ^ 00, we can apply Lemma 1 (with the addition of the time 
sharing random variable). Following the analysis in Section II, it is easy to see that /(A/; Z"\C) < 2nS{e) if 

R- R>I{V;Z\Q) + d{e), 
Ri > I{X;Z\V)+6{e). 

Finally, using Fourier-Motzkin elimination on the set of inequalities completes the proof of achievability. 
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Before proving Theorem 1, we show through an example that the lower bound in Corollary 1 can be strictly 
larger than the rate of the straightforward extension of the Csiszar-Korner scheme to the 2-receiver, 1 -eavesdropper 
setting, 

RcK^ max min{I{V;Yi\Q) ~ I{V] Z\Q),I{V]Y2\Q) - I{V- Z\Q)].. (6) 

p(q)p{v\q)p(x\v) 

Note that Theorem 1 includes Rck as a special case (through setting Vb = Vi = V2 = F in Theorem 1). 

Example: Consider the multilevel product broadcast channel example [8] in Figure 2, where Xi ^ X2 = 3^12 = 
3^21 = {0, 1}, and — Zi = {0,i?, 1}. The channel conditional probabilities are specified in Figure 2. 




Fig. 2: Multilevel broadcast channel 

In Appendix II, we show that Rck < 5/6. In contrast, using Corollary 1, we can achieve a rate of 5/6, which 
shows that the rate given in Theorem 1 can be strictly larger than using the straightforward extension of the 
Csiszar-Korner scheme. 

We now turn to the proof of Theorem 1, which utilizes Marton coding in addition to the ideas already introduced. 
Proof of Theorem 1: 

Codebook generation: Randomly and independently generate a time-sharing sequence g" according to 0"=! PQili)- 
Randomly and conditionally independently generate sequences ^^^(^o), Iq ^ [1 : 2"^], each according to Pv'o|Q(''^0i|9i)- 
Partition the set [1 : 2"-^] into 2"^ bins, B{m), m S [1 : 2"^] as before. For each Ig, randomly and conditionally 
independently generate sequences u"(Zo,ti), ti G [1 : 2"-^^], each according to riiLiPVilVbl^iil^oi)- Partition the 
set [1 : 2"-^i] into 2"-'^i equal size bins, B{lo, h). Similarly, for each Iq, generate sequences ^2(^01 ^2), ^2 G [1 : 2"-^^], 
each according to Y[i=i PV2\Vo{^2i\'Voi) , and partition [1 : 2"-^i] into 2"^^ equal size bins, B{lo, l^)- Finally, for each 
product bin B{Iq,Ii) x B{Iq,12), find a jointly typical sequence pair (i'" (^oi ^i(^Oj ^i))j ''^2 (^Oj ^2(^01 ^2))- If there is 
more than one such pair, randomly and uniformly pick one of them. This encoding step succeeds with probability 
of error that approaches zero as n 00, if [13] 

Ri + R2<Ti+T2~ I{Vi-V2\Vo) - 5{e). 

Encoding: To send message m, the encoder first randomly chooses an index G B{m). It then randomly chooses 
a product bin indices (Li,L2) and selects the jointly typical sequence pair 

{vi{LQ,ti{LQ, Li)),V2{LQ,t2{LQ, L2)). Finally, the encoder generates a codeword X" at random according to 

Yl7=iPx\Vo.Vi,V2ixi\voi,vu,V2i) and transmits it. 

Decoding and analysis of the probability of error: Receiver Yi decodes Lq and hence m indirectly by finding 
the unique index such that (fo (^"o)j ''^i (^~0j 2/") S Te'""'' for some ti G [1 : 2"-^^]. Similarly, receiver Y2 
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finds Lq (and hence m) indirectly by finding the unique index Iq such that {vq (Iq) , V2 {lo , T2)) € 7^'""'' for some 
Z2 G [1 : 2'"-'^^]- Following the analysis given earlier, it is easy to see that these steps succeed with probability of 
error that approaches zero as n ^ 00 if 

R + Ti<IiVo,Vi;Yi\Q)-6ie), 
R + T2 < IiVo,Vi;Y2\Q) ~ 6ie). 

Analysis of equivocation rate: A codebook C induces a joint pmf on Lq, Li, L2, Vq"; ^i"; ^2 i of form 
p(m,^o,^l,/2,^^^,^'^«?^"|c) = 2-"(^+«i+^=)pK, z;?, z;2"|Zo, ^i, ^2, c) Y{UPz\Vo,v^,v,{^^\vm,^h,,V2i). We again 
analyze the mutual information between M and (Z", Q"), averaged over codebooks. 

/(M;Z",g"|C) = /(A/;Z"|Q",C) 

= /(Ti(Lo, Li),T2iLQ, Li), Lo, M; Z"|Q", C) 

- /(Ti(Lo, Li), T2(Lo, L2), Lo; Z"|M, Q", C) 

< /(l^o", Fi", V2^; Z"\Q^, C) - /(Lo; Z"|M, Q",C) 

- /(Ti(Lo, Li), T2(Lo, L2); Z"|Lo, Q", C) 

< nI{Vo, V,,V2; Z\Q) - Lf (Lo|A/, Q", C) + Lr(Lo|M, Q", Z^, C) 

- I{Ti (Lo, Li), T2(Lo, L2); Z"|Lo, Q", C) + nS{e). (7) 

In the last step, we bound the term I(V^, V", V^; Z^'-\Q"-,C) by the following argument, which is an extension of a 
similar argument in [1]. For simplicity of notation, let V = (Vq, Vi, V2). We wish to show that /(y ; Z"|Q",C) < 
nI{V;Z) + nS{e). Note that X is generated according to p{xi\vi). Define L^ = 1 if {q'\v"',z") are not jointly 
typical and otherwise, and N{v) = \{Vi : Vi = Then, 

/(y";Z"|c,Q") < i + p(s = o)/(i^'Z"|c,£; = o,Q") + p(s = i)/(y'Z"|c,£: = 1,0") 
< i + p(s = o)/(i^'Z"|c,£; = o,o") 

+ V{E = l)nlog \Z\ - V{E = l)iL(Z"|C, V", Q", E ^ I) 
= l + V{E = 0)(Lr(Z"|C, L: = 0, Q") - i/(Z"|C, V^", 0") + ?(£; = l)nlog \z\. 

Note that Lf(Z"|C,L; = 0,0") < ?2Lr(Z|g) + n(5(e). For iL(Z"|C, F", Q", £: = 0) = H{Z''%,V'\E = 0), we 
have 

H{Z''\C,E = 0,V")> P(y" = 'L;",C = c)iL(Z"|C = c,y" = i)") 

n 

Y P(^" = i;", C = c) ^ (Z,|C = c, 1^" = w", Z'-i) 



(a) 



i=l 
n 



1=1 



= Y PiV" ^v",C = c)J2n{v)H{Z\V ^v) 



vev 



> E Pl^'^^t'^-C^c) (5^n(p(«)-<5(e))i/(Z|y = i;)) 

> nLr(Z|y) -7i(5'(e), 

where (a) follows since given Vi, Xi is generated randomly according to p{xi\vi) and since the channel is 
memoryless, Zi is independent of all other random variables, and (b) follows since ?j" is typical, which implies that 
N{v) > np{v) — nS{e). Finally, since the coding scheme satisfies the encoding constraints, the proof is completed 
by noting that P(£' = 1) as ?i — > 00 by the law of large numbers and the mutual covering lemma in [11, 
Chapter 9]). 
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We now bound each remaining terms in inequality (7) separately. Note that 

H{LQ\M,Q'',C)^n{R~ R), (8) 

H{Lo\M,Q'\Z",C) < n{So-R-I{Vo;Z\Q) + S{e)), (9) 

where (a) follows by similar steps to the proof of Corollary 1 and application of Lemma 1, which holds if 
P{(Q", Vo"(Lo), Z") e T;^"^} ^ 1 as n ^ oo and S'o - i? > I{Vn;Z\Q). The first condition follows since 
P{(Q",Fo"(io),^i"(io,ri(io,ii)),K,"(io,T2(Lo,L2)),^") e T^'"'} ^ 1 as ti ^ ^. Next, consider 

= H{Ti{Lo,Li), T2{Lo, 2.2)1^0, Q",C) - i/(Ti(Lo, Li), r2(Lo, ^2)1^0, Q", C) 

H{Li,L2\Lo, Q'\e) - H{Ti{L„,Li), T^iLo, ^2)1^0, Q", C) 
> i/(Li, L2|io, 0",C) - i/(ri(io, L,)\Lo, Q", Z", C) - HiT^iLo, L^^Lo, Q", Z", C), (10) 

where (a) holds since given the codebook C and io, (7i,72) is a one-to-one function of {Li,L2)- Now, 

i/(Li,i2|io,Q",C) = n(i?i+i?2), (11) 

H{Ti{Lo,Li)\L„,Q",Z",C) < n{Ti - I{Vi; Z\Vn) + S{e)), (12) 

-ff(T2(Lo, i2)|io, Q", C) < n{T2 - 7(^2; + <5(e)), (13) 

where (&) and (c) come from the following analysis. First consider 

H{T,{Lo, L,)\Lo, g", Z",C) = (ri(Lo, L,M{Lo), Q", io, C) 

<ff(ri(Lo,Li)|T/o",^"). 

We now upper bound the term H{Ti{Lo, Li)|Fo", Z"). 

Since P{iQ",V^iLo),V{'iLo,Ti{Lo,Li)),V2^{Lo,T2{Lo,L2)),Z'') e r}''^ -> 1 as 7W k). 



P{(Vo"(io), V^i"(^o, Ti(Lo, Li)), Z") e T;^"-'} ^ 1 as 71 oo. We can therefore apply Lemma 1 to obtain 

H{Ti{Lo,Li)\Lo,Q'',Z'',C) <n{Ti - I{Vi;Z\Vo) + 6{e)), 

ifTi>I{VuZ\Vo) + S{e). 

The term H{T2{Lq, L2)(Lo,L2)\Lo,Q''^, Z",C) can be bound using the same steps to give 

77(^2(^0, L2)\Lo, Q", Z",C) < n(T2 - I{V2\ Z\V^) + 5(e)), 

if T2 >/(y2;Z|14)) + '5(e). 

Substituting from (11), (12), and (13) into (10) yields 

/(Ti (Lo, ii), T2(io, 7.2); Z"|io, Q", C) 

> 7i(i?i + i?2) - ?i(Ti - /(l/i; Z|Fo) + (5(e)) - n(r2 - /C^^2; Z|14)) + (^le)). (14) 
Substituting inequality (14), together with (8) and (9) into (7) then yields 

1{M- Z''\Qr,C) < n{I{Vi;V2; Z\Vo) +Ti +T2 - R^ - R2 - IiVuZ\Vo) - /(I/2; Z\Vo) + 3<5(e)). 
Hence, /(Af; Z"|Q",C) < 3nS{e) if 

IiVuV2; Z\Vo) +T1+T2-R1-R2- IiVuZ\Vo) - 1(^2; Z\Vo) < 0. 
In summary, the rate constraints arising from the analysis of equivocation rate are 

So-R>IiVo;Z\Q), 
T,>I{Vi;Z\Vo), 
T2>I{V2;Z\Vq), 
Ti+T2-Ri-R2< I{VuZ\Vq) + I{V2; Z\Vo) - /(Fi; ^2; Z\Vq). 
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Applying Fourier-Motzkin elimination gives 

R<I{Vo,Vi;Y,\Q)-I{Vo,Vi;Z\Q), 
R < liVo, V2]Y2\Q)- I{Vo, V2;Z\Q), 
2R<I{Vo,Vi;Yi\Q) + I{Vo,V2;Y2\Q)-2I{Vo;Z\Q)-I{Vi;V2\Vo) 

for some p{q,VQ,vi,V2,x) = p{q,vo)p{vi,V2\vo)p{x\vi,V2,vo) such that /(X^i, V2; Z\Vo) < I{Vi; Z\Vo)+I{V2; Z\Vo)- 
IiVi;V2\Vo). 

The proof of Theorem 1 is then completed by observing that the third inequality is redundant. This is seen by 
summing the first two inequalities to yield 

2R < I{Vo, Vi;Y,\Q)- I{Vo, Vi;Z\Q) + I{Vo, T/2; I2IQ) - I{Vo, V2\Z\Q) 

= I{Vo, Vi;Yi\Q) - I{Vo, Vi;Z\Q) + I{Vo, V2; FalQ) - 2I{Vo; Z\Q) - I{Vi; Z\V„) - I{V2; Z\Vo). 

This inequality is at least as tight as the third inequality because of the constraint on the pmf. This completes the 
proof of Theorem 1 . 

Special Cases: 

We consider several special cases in which the inner bound in Theorem 1 is tight. 

Reversely Degraded Product Broadcast Channel: As an example of Theorem 1, consider the reversely degraded 
product broadcast channel with sender X = (Xi, X2 Xfc), receivers Y, = {Yji,Yj2 ■ ■ ■ ,Yjk) for j = 1,2,3, and 
conditional probability mass functions p{yi,y2, z\x) ^ Tlf^i p{.yihy2i, zi\xi). In [5], the following lower bound on 
secrecy capacity is established 

k 

Cs> mm J2^I{Ui;Y^i)-I{Ui;Zi)]+. (15) 

je{i,2} 

for some p{ui, . . . ,Uk, x) = Y['i=iPi''^i)pi^iWO- Furthermore, this lower bound is shown to be optimal when 
the channel is reversely degraded (with Ui = Xi), i.e., when each sub-channel is degraded but not necessarily 
in the same order We can show that this result is a special case of Theorem 1. Define the sets of I indexes: 
C = {I : I{Ui-Yu) - I{Ui-Zi) > Q,I{Ui-Y2i) - I{Ui-Zi) > Q}, A = {I : I{Ui-Yn) ~ I{Ui- Zi) > 0} and 
B = {1: I{Ui-Y2i) - I{Ui- Zi) > 0}. Now, setting = {Ui : I e C}, = {(7, : / e A}, and V2 = {Ui : I ^ B} 
in the rate expression of Theorem 1 yields (15). Note that the constraint in Theorem 1 is satisfied for this choice 
of auxiliary random variables. The expanded equations are as follows: 

I{Vu V2\ Z\Vo) = I{Ua, Ub; Z\Uc) 

= I{Ua\c, Ub\ci Z\c) 
= I{Ua\c': Z^a\c) + I{Ub\c\ Z^b\c) 
= I{Vi;Z\Vo)+I{V2;Z\V^), 
/(Fo, Fi; Fi) - I{Vo,Vi-Z) = I{Ua; Y^.a) - I{Ua\ Za), 
I{Vo,Vi;Yi) - I{Vq,Vi; Z) = I{Ub;Yi,a) - I{Ub; Zb), 
I{Vi;V2\V„)^I{Ua\c;Ub\c)^0- 

Receivers Yi and Y2 are less noisy than Z: Recall that in a 2-receiver broadcast channel, a receiver Y is said to 
be less noisy [14] than a receiver Z if I{U ; Y) > /([/; Z) for all p{u, x). In this case, we have 

Cs^m&xnim{I{X;Yi)-I{X;Z),I{X;Y2)-I{X;Z)}. 

p(x) 

To show achievability, we set Q = and Vi^ = Vi ^ V2 = V-3 ^ X in Theorem 1. The converse follows similar 
steps to the converse for Proposition 2 in Subsection IV-B given in Appendix IV and we omit it here. 
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B. 2-Receivers, 1 -Eavesdropper with Common Message 

As a generalization of Theorem 1, consider the setting with both common and confidential messages, where we 
are interested in achieving some equivocation rate for the confidential message rather than asymptotic secrecy. For 
this setting we can establish the following inner bound on the secrecy capacity region. 

Theorem 2: An inner bound to the secrecy capacity region of the 2-receiver, 1 -eavesdropper broadcast channel 
with one common and one confidential messages is given by the set of non-negative rate tuples {Ro,Ri, Re) such 
that 

Ro<IiU;Z), 

Ro + Ri< I{U: Z) + min{/(V^o, Vi-Y^\U) - I{Vi-Z\Vq), /(K), V2;Y2\U) - /(I/2; Z\Vq)}, 
Ro + R,< mm{I{Vo, V,;Y,) - liV^; Z\Vo), I{Vo,V2;Y2) - I{V2] Z\Vo)}, 

Re ^ Rl, 

R, < min{/(K), Vi;Y,\U) - I{V„,Vi; Z\U), I{Vo, V2; Y2\U) - I{Vo, V2; Z\U)}, 
Ra + Re< mm{I{Vo ,Vi;Yi) ~ I{Vi,Vo; Z\U), I{V„,V2;Y2) ~ I{V2,Vo; Z\U)}, 
Ro + 2i?e < I{Vo, Vi;Yi)+ I{Vo, V2]Y2\U) ~ I{Vi; V2\Vo) - 21 {Vo; Z\U), 
Ro + 2i?e < I{Vo, V2;Y2)+ I{Vo, Vi;Yi\U) ~ I{Vi; ¥2%)- 21 {Vo; Z\U), 
R0 + R1+ 2R, < I{Vo, V2;Y2\U) - I{V2; Z\Vo) + I{Vo, Vi;Yi) 

+ I{Vo,V2;Y2\U)~I{Vi;V2\Vo)~2I{Vo;Z\U), 
R0 + R1+ 2Re < liVo, VuY,\U)~ I{Vi;Z\Vo) + /(Fq, V2; Y2) 

+ I{Vo.Vi;Yi\U)-I{VuV2\Vo)~2I{Vo;Z\U), 

for some p{u,vo,vi,V2.,x) = p{u)p{vo\u)p{vi,V2\vq)p{x\vq,vi,V2) such that I{Vi,V2; Z\V{)) < I{Vi;Z\Vo) + 
I{V2;Z\Vo)-I{Vi;V2\Vo). 

Note that if we discard the equivocation rate constraints and set Vo ~ Vi — V2 = X, this inner bound reduces to 
the straightforward extension of the Korner-Marton degraded message set capacity region for the 3 receivers case 
[8, Corollary 1]. 

If we take Vq ~ Vi = V2 = V and Yi — Y2 — Y, then we obtain the region consisting of all rate pairs {Ro,Ri) 
such that 

Ro<I{U;Z), (16) 
i?o + i?i <I{U;Z)+I{V;Y\U), 
Ro + Ri<I{V;Y), 

Re ^ Rl, 

Re < I{V;Y\U)~I{V;Z\U), 
Ro+Re<I{V;Y)-I{V;Z\U) (17) 

for some p{u, v, x) — p{u)p{v\u)p{x\v). 

This region provides an equivalent characterization of the secrecy capacity region of the 2-receiver broad- 
cast channel with confidential messages [2]. To see this, note that if we tighten the first inequality to Rq < 
min{/(J7 ; Z),I{U ; Y)}, the last inequality becomes redundant and the region reduces to the original characterization 
in [2]. 

Proof of Theorem 2: 

The proof of Theorem 2 involves rate splitting for i?i(= R'l + R'{). We first establish an inner bound without 
rate splitting. The proof with rate splitting is given in Appendix 111. 

Codebook generation: Fix wq, i"!, W2, a;) and let i?^ > be such that Ri — Re + Rr > I{Vq;Z\U) + (5(e). 
Randomly and independently generate sequences w"(mo)i "t-o G [1 ■ 2"^"], each according to n"=i -Pc/ (""«)■ 
For each ttlq, randomly and conditionally independently generate sequences Vq (mo, toi, m^), {mi,mr) G [1 : 
2n(i?.i+flr)]^ each according to YVi^iPva\u{'^oi\ui). For each {mo,mi,mr), generate sequences w"(mo, 7711,771^,^1), 
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ti e [1 : 2""^!], each according to n"=iPVi|yo(''^iiK'oi)' ^"d partition the set [1 : 2""^!] into 2"^^ equal size bins 
B{mo,mi,mr,li). Similarly, for each (mo, mi, m, ), randomly generate sequences (mo, mi, mr-, ^2), ^2 G [1 : 
2nT2j g^^jj according to n"=i PV2IV0 (''^ailwoi) and partition the set [1 : 2""^^] into 2"^^ bins B{mo,mi,mr,l2)- Fi- 
nally, for each product bin B{li)xB{l2), find a jointly typical sequence pair (w" (mo, mi, m^, <i(/i)), (tjo, mi, m^, t2{l2))- 
If there is more than 1 pair, we randomly and uniformly pick a pair from the set of jointly typical pairs. As before, 
the probability of error approaches zero as n — > 00 if 

Ri+R2<Ti+T2~I{Vi;V2\Vo)~S{e). 

Encoding: To send a message pair (mo,mi), the encoder first chooses a random index m^ G [1 : 2"^''] and then 
the sequence pair (u" (mg), Uq (mi, m^, mo)). It then randomly chooses a product bin indices (Li, ^2) and selects 
the jointly typical sequence pair 

(w" (mo, mi, m^, ti(Li)), (mo, mi, m^, t2(-^2)) in it. Finally, it generates a codeword X" at random 
according to Yl"=iPx\Vo,Vi.V2{xt\vot,vu,V2t). 

Decoding and analysis of the probability of error. Receiver Yi finds (mo, mi) indirectly by looking for the unique 
(mo,fo) such that (u" (mg), Vq ("^Oj ^o), ''^"('tio, ^"o; '1)) G '7^^"'' for some Zi G [1 : 2"-^i]. Similarly, receiver 1^2 finds 
(mo, mi) indirectly by looking for the unique (mo,/o) such that (w"(mo), Uq (tjo, /o)i ^'"("lo, ^2)) £ Te^""* for 
some ^2 G [1 : 2"-^^]. Receiver Z finds mo directly by decoding U. These steps succeed with probability of error 
approaching zero as 71 — > co if 

i?o + i?i + Ti + Rr < I{Vo,Vi;Yi) - S{e), 

Ri+Ti+Rr<I{Vo,Vi;Yi\U)-5ie), 
R0 + R1+T2 + Rr < I{Vo,Vi;Y2) - (5(e), 

Ri+T2 + Rr<I{V„,Vi;Y2\U)-6{e), 
Ro<I{U;Z). 

Analysis of equivocation rate: We consider the equivocation rate averaged over codes. We will show that a part of 
the message Mip can be kept asymptotically secret from the eavesdropper as long as rate constraints on R^ and 
Ri are satisfied. Let i?i = Rip + Ric and R^ = Rip. 

H{Mi\Z'\C) > H{Mip\Z'\Mo,C) 

= H{Mip) - /(Mip; Z"|Afo,C) (18) 

(a) 

> H{Mip) - 3nS{e) 

= n{Ri - /(Vb; Z\U)) - 3n5{e). 

This implies that Re < Ri — I{Vo; Z\U) — 3(5(e) is achievable. 
To prove step (a), consider 

/(Mip; Z"|Mo,C) = /(ri(ii), T2(L2), Afip, Afi„ Af,; Z"|A/o,C) - I{Ti{Li),T2{L2), A'h,, A/,; Z"|A/ip, A/o,C) 

{b) 

< I{Vo" , Vr , ; I A//o , C) - I {Mi, , A/, ; Z" | A/ip , A/o , C) - /(Ti (Li ) , T2 (L2 ) ; ^" | A'/i , Mo , Af„ C) 

< /(Fo", Fi", Z"\U", C) - /(A//i„ A//,; Z"|A/ip, A'/o,C) - /(Ti(Li), r2(i2); ^"|Afi, A^o, A/„C) 

< n/(Fo, 14,^2; Z|[/) + nd{e) - H{Mie, Mr\Mip, [/", C) + i/(A/i„ A/,|A/ip, Mq, Z",C) 

- /(Ti (Li ) , (L2) ; ^" I Af 1 , Mo ,Mr,C) 

< nI{Vo, Vi,V2; Z\U) + nd{e) ~ n(i?i - R^ + R,-) + H{Mie, Mr\Mip, Mq, Z'\C) 

- /(Ti (Li ) , (L2) ; ^" I A/i , Mo , A/„ C) , 

where (&) follows by the data processing inequality and (c) follows by the observation that is a function of 
(C,Afo) and (C,Afo) ^ (C, [/" ,!/") Z". Following the analysis of the equivocation rate terms in Theorem 1 
and using Lemma 1, the remaining terms can be bounded by 

i/(Afi„ A//,|A'/ip, A/o, C) < i/(A/i„ Af.lAfip, [/", Z^) 
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< n{Ri -Re + Rr) - nI{Vo] Z\U) + n5{e), 
I[Ti{Li),T2{L2)\Z'^\MuMo,Mr,C) ^ H{Ti{Li),T2{L2)\Mi,Mo^ 

= n{Ri+R2)-H{Ti{Li),T2{L2)\A'h,MQ,Mr,C,Z'') 

+i?2) -i^m(ii),T2(L2)|Af,,Mi,Mo,Fo",C,Z") 

> n{Ri+R2)- H{Ti{Li),T2iL2)\Vo",Z") 

> n{Ri +R2-T1- T2) + n{I{Vi-Z\Vo) + /(Fa; Z\V^)) - 2n5{e), 

if Ti > I{Vi]Z\Vo) + (5(e), and T2 > I{V2;Z\Va) + (5(e). Step (a) follows from the observation that yj' is a 
function of (C,Mo,Mi). 
Thus, we have 

/(Mip; Z"|Afo,C) < 1(1^1,^2; Z\V^) - I{Vi-Z\Vo) - /(F2; Z\Vo) + n(ri +T2-R1- R2) + 4n(5(e). 
Hence, I{Mip; Z" \Mo,C) < 4nS{e) if 

/(Vi; F2; Z\Vo) +T1+T2-R1- R2 - I{Vi;Z\Vo) - /(F2; Z\Vo)) < 0. 
Substituting back into (18) shows that 

H{Mi\Z",C) > n{Ri - I{Vo; Z\U) - 4n5{e). 
The equivocation rate constraints on the rates are 

Re < Ri, 

Rr > 0, 

Ri-Re + Rr>I{V„;Z\U), 
Ti>I{Vi;Z\Vo), 
T2>I{V2;Z\Vo). 

Using Fourier-Motzkin elimination then gives us an inner bound for the case without rate splitting. The proof with 
rate splitting on i?i is given in Appendix 111. 

Special Case: 

We show that the inner bound in Theorem 2 is tight when both Yi and Y2 are less noisy than Z. 

Proposition 2: When both Yi and Y2 are less noisy than Z, the 2-receiver, 1 -eavesdropper secrecy capacity 
region is given by the set of (i?o, Ri,Re) tuples such that 

Ro<I{U;Z), 

Ri <mm{I{X;Yi\U),I{X;Y2\U)}, 

Re < [i-nm{Ri, I{X;Yi\U) - I{X; Z\U), I{X;Y2\U) - I{X; Z\U)}] + 

for some p{u, x). 

Achievability follows by setting Vo = Vi = V2 = X in Theorem 2 and using the fact that Yi and I2 are less noisy 
than Z, which allows us to assume without loss of generality that _Ro < niin{/(C/; Z), /([/; Yi), /([/; 12)}- The 
set of inequalities then reduce to 

Ro<I{U;Z), 
Ro + Ri< I{U; Z) + min{/(X; Yi\U),I{X- Y2\U)], 

Re < Rl, 

Re < min{I{X;Yi\U) - I{X;Z\U),I{X;Y2\U) - I{X;Z\U)}. 
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Since the region in Proposition 2 is a subset of the above region, we have established the achievability part of 
the proof. Achievability in this case, however, is a straightforward extension of Csiszar and Korner and does not 
require Marton coding. For the converse, we use the identification Ui = {Mq, Z'-^^). With this identification, the 
Rq inequality follows trivially. The Ri and R^ inequalities follow from standard methods and a technique in [8, 
Proposition 11]. The details are given in Appendix IV. 

V. 1 -RECEIVER, 2-EAVESDROPPERS WIRETAP CHANNEL 

We now consider the case where the confidential message Mi is to be sent only to Yi and kept hidden from the 
eavesdroppers Z2 and Z3. All three receivers 11,^2,^3 require a common message A/q. For simplicity, we only 
consider the special case of multilevel broadcast channel [10], where p{yi, Z2, z^lx) = p{yi, Z3\x)p{z2\yi)- In [8], 
it was shown that the capacity region (without secrecy) is the set of rate pairs (Rq, Ri) such that 

i?o < mm{I{U;Z2),I{U3;Z3)}, 
Ri < I{X;Yi\U), 
Ro + Ri<I{Us;Z3)+I{X;Yi\U3) 

for some p{u)p{u^\u)p{x\u^). We extend this result to obtain inner and outer bounds on the secrecy capacity region. 

Proposition 3: An inner bound to the secrecy capacity region of the 1 -receiver, 2-eavesdropper multilevel broad- 
cast channel with common and confidential messages is is given by the set of rate tuples {Rq, Ri, Re2, Res) such 
that 

i?o<min{/(C/;Z2),/(;73;Z3)}, 
Ri < I{V;Yi\U), 
Ro + Ri<I{U3;Z3)+I{V;Yi\U3), 

Re2 < mm{Ri,I{V; Yi\U) - I{V; Zajt/)}, 

Re2 < [I{U3; Zs) - i?o - Z2\U)]+ + I{V; YilU^) - I{V; Z2|[/3), 
Re3 < mm{Ri, [/(F; Yi |(73) - I{V; ZslU^T}, 

Re2 + Re3 < Rl + I{V\ Yi\U:i) - I{V- Z2\U:i), 

for some p(it, it3, w, x) = p{u)p{u3\u)p{v\u3)p{x\v) . 

It can be shown that setting Yi = Z2 = Y and Z-^, = Z gives an alternative characterization of the secrecy 
capacity of the broadcast channel with confidential messages. 

Proof of achievability: We break down the proof of Proposition 3 into four cases and give the analysis of the first 
case in detail. The analyses for the rest of the cases are similar and we therefore we only provide a sketch in Appendix 
V. Furthermore, in all cases, we assume that Ri > min{/(X^; Yi\U3)~I{V; Z2\U3), [I{V; Yi\U3)-I{V; Z3\U3)] + }. 
It is easy to see from our proof that if this inequality does not hold, then we achieve equivocation rates of 
Re2 = Re3 = ^1 for any rate pair(i?o, ^^i) satisfying the inequalities in the proposition. The four cases are: 

. Case 1: I{U3\ Z3) - Rq - I{U3\ Z2\U) > 0, /(T/; rilf/3) - /(F; Z2IC/3) < /(F; Yi It/3) - /(F; Z3 It/3) and 
Re3>IiV]Yi\U3)~I{V;Z2\U3y, 

. Case 2: /(t/3; Z3) - i?o - /(t/3; ^2|t/) > 0, I{V;Yi\U3) - I{V; Z2\U3) < I{V;Yi\U3) - HV; Z3\U3) and 

Re3<IiV]Yi\U3)^I{V;Z2\U3); 

. Case 3: /(t/3; Z3) - i?o - /(t/3; ^2|t/) > 0, IiV;Yi\U3) - I{V; Z2\U3) > I{V;Yi\U3) - !{¥; Z3\U3). In this 
case, since we consider only the case of i?i > I{V; Yilt/3) — I{V; Z3\U3), we will see that an equivocation 
rate of R,3 = I{V; Yilt/3) - I{V; Z3\U3) can be achieved; 

• Case 4: /(t/3; Z3) - Rn - /(t/3; Z2\U) < 0. 

Now, consider Case 1, where /(t/3; 2-3) - Rq - I{U3] Z2\U) > 0, I{V;Yi\U3) - I{V] Z2\U3) < /(F; Yilt/3) - 
IiV;Z3\U3) and R,3 > I{V;Yi\U3) - I{V; Z2\U3). 
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Codebook generation: Fix p{u,U3,v,x) ~ p(it)p(u3|u)p(u|u3)p(x|'(;). Let R\ = RIq + R^q + R'n + R'd + Rl^. 
Let Rq>Q and i?^^ > be the randomization rates introduced by the encoder These are not part of the message 
rate. Let = i??o + + -^o and = R[^ + + R^^ + R\. 

Randomly and independently generate sequences u"(7tio), friQ G [1 : 2"^"], each according to YYi^iPuiui). 
For each rriQ, randomly and conditionally independently generate sequences u'^^{mQ,l[)), G [1 : 2"^!"], each 
according to YYi^iPu3\u{u^i\'^i)- For each (mo, lo), randomly and conditionally independently generate sequences 
w"(mo,Zo,'i), ^1 G [1 : 2"^"], each according to ]X^=iPv\u-AviW^i)- 

Encoding: To send a message (mo, mi), we split mi into sub-messages with the corresponding rates given in the 
codebook generation step and generate the randomization messages (m^^Q, m\^) uniformly at random from the set 
[1 : 2"^(i] X [1 : 2"^i]. We then select the sequence u"(mo,/o7^i) corresponding to (mo, mi, m^^Q, m^^j^) and send 
X" generated according to ]Xi^iPx\v{xi\vi{li,lo,mo)). 

Decoding and analysis of the probability of error: Receiver Yi finds (mo, mi) by decoding {U,U^,V), Z2 finds 
mo by decoding U, and Z3 finds mo indirectly through ([/, t/3). The probability of error goes to zero as n — > cxd if 

i?o + Rio + RI + Rio < Hu^; Zs) ~ s{e), 

Rlo + R1o + Rl<HU3;Y,\U)-Sie), 
R[^ + i?'i'i + i??i +Rl< I{V; Y,\U3) - S{e). 

Analysis of equivocation rates: We show that the following equivocation rates are achievable. 

Re2 = Rio + R'li - ^(e)> 
Re3^R'n+Rn-S{e). 

It is straightforward to show that the stated equivocation rate R^s is achievable if 

Rl + R1^ > I{V;Z3\U3) + 6{e). 

The analysis of the H{Mi\Z2 ,C) term is slightly more involved. Consider 

/(Affo: Mi,; Z^'|A/o,C) ^ /(io, Z'^ \C, Mo) - /(Lq, £1; Z'^ \C, Mq, Af^^, M[,) 

< /(!/"; Z^\C, [/") - /(io; Z'^T, Mo, M^o, M[i) - I{W,Z^ \C, Mq, Lo, M[,) 

n 

< HV; Z.2\U) - /(io; Zl^\C, Mo, Mlo, Mn) - I{W,Z-^\C, Mq, ^o, Mn). 
1=1 

Now consider the second and third terms. We have 

/(Lo; ^2 |C, Mo, Mlo, M[,) = H{Lo\C, Mo, M^^, M[,) - H{Lo\C, Mo, M^^, M[„Z^, C/") 

> n(i?io - Rto) - H{Lo\C, Mf^, Z^, C/") 
>niI{Us;Z2\U)^S{e)). 

The last step follows from Lemma 1, which holds if 

RiQ — R'lQ = RiQ + Rq 

>I{U3;Z2\U)+6{e). 

For the third term, we have 

I{Li;Z'^\C, Mo, Lo, M[,) = H{Li\C, Mo, Lo, M[,) - H{Li \C, Mo, Lo, M[,, Z'i, [/") 

> n(i?ii - i^'ii) - H(Li\C, M[,, Z'i, t/") 

> n(i?ii - i^'ii) - n(i?ii - i^'ii - I[V; Z2IC/3) + (5(e)). 
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In the last step, we again apply Lemma 1, which holds if 

+ +Rl> liV; Z^U3) + (5(e). 
In summary, the inequalities for Case 1 are as follows: 

Decoding Constraints: (with i?o < I{U;Z2) omitted since this inequality appears in the final rate-equivocation 
region and does not contain the auxiliary rates to be eliminated.) 

^0 + ^10 + -Rq + -^10 < HUsiZ^), 
R{^ + Rl^ + R^<I{U3-Yi\U), 
+ + +Rl< I{V- FilC/a). 

Equivocation rate constraints: 

R°,, + R:> I{U3;Z2\U), 
R'l,+R[ + R°,,> I{V;Z2\U3), 
R[ + R1,> I{V;Z3\U3). 

Greater than or equal to zero constraints: 
Equality constraints: 

R\ = ^10 + -^10 + -^'ii + -^11 + ^11 1 
Re-2 = Ria + R'll, 
Re3 ^ R'll + ^11- 

Applying Fourier-Motzkin elimination yields the rate-equivocation region for Case one. Sketch of achievability 
for the other cases are given in Appendix V. 

We now establish an outer bound and use it to show that the inner bound in Proposition 3 is tight in several 
special cases. In contrast to the case with no secrecy constraint [8], the assumption of a stochastic encoder makes 
it difficult to match our inner and outer bounds in general. 

Proposition 4: An outer bound on the secrecy capacity of the multilevel 3-receiver broadcast channel with one 
common and one confidential messages is given by the set of rate tuples (i?o, ^i, Re2, Res) such that 

Ro<mm{I{U;Z2)J{Ur,Z3)}, 
Ri<I{V;Yi\U), 
Ro + Ri<I{U3;Z3)+I{V;Yi\U3), 
Re2 < I{X;Yi\U) - I{X; Z2\U), 

Re2 < [I{U3; Zs) - i?o - /(f/a; Z2\U)]+ + I{X; FilC/g) - I{X; Z2IC/3), 
Re3 < [I{V;Yi\U3)~I{V;Z3\U3)]+ 

for some U3, v, x) — p{u)p{u3\u)p{v\u3)p{x\v). 

Proof of this Proposition uses a combination of standard converse techniques from [15], [16], and [2] and given in 
Appendix VI. 

Remark 5.1: As we can see in the inequalities governing i?e2 in both the inner and outer bounds, there is a tradeoff 
between the common message rate and the equivocation rate at receiver Z2. A higher common message rate limits 
the number of codewords that can be generated to confuse the eavesdropper 
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Special Cases 

Using Propositions 3 and 4, we can establish the secrecy capacity region for the following special cases. 
Yi more capable than Z3 and Z3 more capable than Z2: If Yi is more capable [15] than Z3 and Z3 is more 
capable than Z2, the capacity region is given by: 

i?o <min{/([/;y2),/(C/3;^3)}, 
Ri<I{X-Yi\U), 
Ro + Ri<I(U3;Z3)+I{X;Y,\U3), 
Re2 < I{X-Yi\U) - I{X;Z2\U), 

Re2 < [/(C/3; Z3) -Ro- /(C/3; Z2\U)]+ + I{X; Y1IC/3) - I{X; Z2IC/3), 

Re3<I{X;Yi\U3)^I{X-Z3\U3) 

for some p{u, U3, x) = p{u)p(u3\u)p(x\u3). 

Achievability follows directly from setting V = X and observing that since Z3 is more capable than Z2, the 
inequality R,2 + Re3 < Ri + I{X;Yi\U3) - I{X;Z2\U3) is redundant since I{X\Yi\U3) - I{X;Z2\U3) > 
I{X;Yi\U3) — I{X; Z3\U3) from the more capable condition. For the converse, observe that since Yi is more 
capable than Z3, we have 

I{V; Yips) - I{V- Z3IC/3) - I{V, X- Yi\U3) - I{V, X; Z3\U3) - I{X; Yi\V) + I{X; Z3\V) 

<IiX;Y,\U3)-I{X;Z3\U3). 

One eavesdropper. Here, we consider the two scenarios where either Z2 or Z3 is an eavesdropper and the other 
receiver is neutral, i.e., there is no constraint on its equivocation rate, but it still decodes a common message. The 
secrecy capacity regions for these two scenarios are as follows. 

Z3 is neutral: The secrecy capacity region is the set of rate tuples {Rq, Ri, R^2) such that 

i?o <min{/([/;y2),/(C/3;^3)}, 
Ri<I{X;Y,\U), 
Ro + Ri<I{U3;Z3) + I{X;Yi\U3), 
Re2<I{X;Yi\U)-I{X;Z2\U), 

Re2 < [HUs; Z3) - i?o - /(C/3; Z2\U)]+ + I{X; YilUs) - I{X; Z2IC/3) 
for some p{u, U3, x) = p{u)p(u3\u)p{x\u3). 

Z2 is neutral: The secrecy capacity region is the set of rate tuples {R^, Ri, Re3) such that 

i?o <min{/([/;Z2),/(C/3;^3)}, 
Ri < I{V;Y,\U), 
Ro + Ri <I{U3;Z3)+I{V;Yi\U3), 

Re3 < [I{V;Y,\U3)-I{V;Z3\U3)] + 

for some p(u,U3,v,x) = p{u)p{u3\u)p{v\u3)p(x\v). 

VI. Conclusion 

We presented inner and outer bounds on the secrecy capacity region of the 3-receiver broadcast channel with 
common and confidential messages that are strictly larger than straightforward extensions of the Csiszar-Korner 
2-receiver region. We considered the 2-receiver, 1 -eavesdropper and the 1 -receiver, 2-eavesdroppers cases. For the 
first case, we showed that additional superposition encoding, whereby a codeword is picked at random from a 
pre-generated codebook can increase the achievable rate by allowing the legitimate receiver to indirectly decode the 
message without sacrificing secrecy. A general lower bound on the secrecy capacity is then obtained by combining 
superposition encoding and indirect decoding with Marton coding. This lower bound is shown to be tight for the 
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reversely degraded product channel and when both Yi and Y2 are less noisy than the eavesdropper. The lower 
bound was generalized in Theorem 2 to obtain an inner bound on the secrecy capacity region for the 2-receiver, 
1 eavesdropper case. For the case where both Yi and Y2 are less noisy than the eavesdropper, we again show that 
our inner bound gives the secrecy capacity region. 

We then established inner and outer bounds on the secrecy capacity region for the 1 -receiver, 2-eavesdroppers 
multilevel wiretap channel. The inner bound and outer bounds are shown to be tight for several special cases. 
In the results for both setups, we observe a tradeoff between the common message rate and the eavesdropper 
equivocation rates. A higher common message rate limits the number of codewords that can be generated to confuse 
the eavesdroppers about the confidential message. In addition, in the second setup, a higher common message rate 
can potentially reduce the equivocation rate of one eavesdropper while leaving the equivocation rate at the other 
eavesdropper unchanged. 
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Appendix I 
Proof of Lemma 1 

First, define N{V,Z'') = |{fc e [1 : 2"^] : (t/", y"(/fc), Z") £ Te^"'}!. Next, we define the following "error" 
events. Let = 1 if {7V(C/",Z") > (1 + Ji(e))2"('S--f(^'^l'^)+*'(^))} ^^^^j = otherwise. Let 

£; = if ([/",l^"(L),Z") e 7;'"^ and £:i(C/", Z", L) = 0, and = 1 otherwise. We now show that if 5 > 
I{V; Z\U) + 5{e), then V{E = 1} — > as n — > cxd. By the union of events bound, 

V{E=l} < P{(i7",l/"(L),Z") i %^''^ + P{EiiU'\Z'\L) = 1}. 
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The first term tends to zero as ?i — !■ cxd by assumption. The second term is bounded as follows 

P{Ei{U'\Z'') = 1} = J2 Piu'')P{iEiiU'\Z") ^l)\U'' ^u"} 

= J2 J2 p(M")P{(£;i(M",z") = i)n(Z" = z")|c/" = it"} 

= J2 p(m")P{(-Bi(m",z") = l)n(Z" = z")|C/" = 'u"} 

«"Gri"' z"eri'''(2|;7) 

< E p{(i?i(w",^") = i)ic/" = ^."}. 

Now, P{£;i(u",z") = = u"} = P{7V(w",z") > (1 + Ji(e))2"('5--f(^;^i'^)+'5(^))|[/" = «"}. Define Xk 1 
if (w", z") G T;^"^ and 0, otherwise. We note that Xk, k e [1 : 2"% are i.i.d. Bernoulli p random variables, 

where 2-"(^(^;2|^)+^(^)) <p< 2-"(^(V;2|c/)-5(0). We have 



2"- 



< 



fc=i 

Applying the Chernoff Bound (e.g., see [11, Appendix B]), we have 



P l^Xfc > (1 + ^i(e))2"^p|t/" = < cxp{~2"''pSl{e)/4) 

<exp(-2"(^-^(^^^l^)-^(^»<5?(e)/4). 

Hence, 

P{£;i(f/",Z") = 1} < ^ ^ exp(-2"('^-^(^'^l^)-*'('^»52(^)/4) 

< 2"'°sl^l exp(-2"(^-^(^^^l^)-*(^))<52(^)/4)^ 

which tends to zero as n — > oo if S* > I{V; Z\U) + (5(e). 
We are now ready to bound H{L\C, Z", [/"). Consider 

H{L, E\C, U" , Z") < 1 + P{E = 1}H{L\C, E=l, U" , Z") + P{E = 0}H{L\C, E^O, U'\ Z") 
< 1 + P{£ = l}nS + log((l + j^(e))2"(^^-^(^;2|c^)+«(^))) 
<n{S-IiV;Z\U) + 6'ie)). 

This completes the proof of the lemma. 

Appendix II 
Evaluation for example 

We first give an upper bound for the extended Csiszar-Korner lower bound. 

Fact: The extended Csiszar and Korner lower bound in (6) for the channel shown in Figure 2 is upper bounded 

by 

RcK < min{/(Xi; Fn) - I{Xi; Zi) + /(F2; FialQa) - HV2; Z2IQ2), /(^i; ^21) 
-I{Xi;Zi)-I{V2;Z2\Q2)}. 
for some p{xi)p{q2,V2)pix2\v2). 
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Proof: From (6), we have 

R< max ^in{I{V-Yi\Q)-I[V-Z\Q),I{V-Y2\Q)-I{V-Z\Q)}. 

p{q)p{v\q)p(x\v) 

Consider the first bound for i?cK- 

I{V; Yi\Q) - I{V; Z\Q) = I{V; Fn, FialQ) - I{V; Zi\Q) - I{V; Z2IQ, Zi) 

< I{V; Yii, ri2, ^1 IQ) - I{V; Z,\Q) - I{V; Z2\Q, Z^) 
= I{V; Yn,Yi2\Q, ^1) - I{V; Z2\Q, Z{) 

= I{V; Yn\Q, ZuYi2) + I{V; Y12 |Q, Z^) - I{V; Z2IQ, Z^) 

= I{V; Y^^,Z^\Q, Y^2) - I{V\ Z,\Q, Y,2) + I{V; Y,2\Q, Z,) - I{V; Z2IQ, Z^) 

I{y- Fii |g, Y12) - I{V- Zi\Q, Yi2) + I{V- Yi2|g, Z^) - I{V; Z2\Q, Zi) 

< I{V'; Yn\Q) - I{V'; Z,\Q) + I{V; Y,2\Q, Z,) - I{V; Z2IQ, Z,). 

(a) follows from the structure of the channel which gives the Markov condition (Q, Y12, V) — Yu — Z\. The last 
step follows from defining V = (V, F12) and the fact that Z\ is a degraded version of Y\\. 
Consider now the second bound. 

= I{V; Y2i\Q) - I{V; Z^\Q) - I{V: Z2 |Q, Z^) 
< I{V'; Y2i\Q) - I{V'; Zi\Q) ~ I{V; Z2IQ, Zi). 

Combining the bounds, we have 

RcK< max miii{I{V';Yii\Q) -!{¥'; Zi\Q) + I{V;Yi2\Q, Z^) - I{V; Z2\Q, Z^), (19) 

p{q,v,v' ,Xi,X2) 

I{V'\ Y2i\Q) - I{V'- Z^\Q) - I(V; Z2IQ, Z,)} 

Now, we note that the terms I{V';Yii\Q) - I{V';Zi\Q) and /(X^';l2i|Q) - /(F';Zi|Q) depends only on the 
marginal distribution p{q,v' ,xi)p{y2i,yii, zi\xi). Similarly, define Q' = {Q,Zi), the terms I{V;Yi2\Q') — 
I{V; Z2\Q') and I{V; Z2\Q') depends only on the marginal distribution p{q' ,v,X2)p{y 12, Z2\x2)- Therefore, we 
can further upper bound Rck by 

RcK < maxmm{I{Vi;Yn\Qi) ~ I{Vi; Zi\Qi) + I{V2;Yr2\Q2) - IiV2; Z2\Q2), 
I{Vi;Y2i\Qi) - I{Vi;Zi\Qi) - /(F2; Z2IQ2)} , 

where the maximum is over p{qi)p{vi\qi)p{xi \vi) and p{q2)p{v2\q2)p{x2\v2) '• We now further simplify this bound 
as follows. 

Rck < maxmm{I{Vi;Yii\Qi)^IiVi;Zi\Qi)+I{V2;Yr2\Q2)-I{V2;Z2\Q2), 
I{Vi;Y2i\Qi) ~ I{Vi; Zi\Qi) - I{V2; Z2\Q2)} , 
< max mill - /(^i; ^1) + /(^2; ^121^2) - /(^2;^2|Q2), 

I{Xi;Y2i) - I{Xi;Zi) - I{V2; ^21^2)} , 

where the maximum is now over distributions of the form p{xi) and p{q2)p{v2\q2)p{x2\v2)- The last step follows 
from the fact that Zi is degraded with respect to both y2i and Yu. ■ 
Next, we evaluate this upper bound. We will make use of the entropy relationship [17]: H{ap, 1 — p, (1 — a)p) = 
H{p, 1 — p) + pH{a, 1 — a). First consider the terms for the first channel components, 

'To see that this bound is larger than the previous bound in (19), set Vi = V, Qi = Q, V2 = iV,Q') and Q2 = Q' in this bound to 
recover the previous bound 
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(/(Xi; Yii) - I{Xi;Zi)) and {I{Xi-Y2i) - I{Xi;Zi)). Letting P{Xi = 0} = 7 and evaluating the individual 
expressions, we obtain 

/(Xi;y2i) = ff(7,l-7), 

iixr,Y,,)^H(i,y-^yi 

^ ^' ^' V6 6' 6 J V6 e; 

= ii/(7,l-7)- 

This gives 

I{Xi;Y2i) - /(Xi; Zi) = ^Hij, 1 - 7), 
/(XijFn) - I{X,;Z,) = ^^(7, 1 - 7). 
Note that both expressions are maximized by setting 7 = 1/2, which yields 

RcK < min |i + I{V2;Yi2\Q2) ~ /(1^2; ^2|Q2), \ - KVi; ^2|Q2)| . (20) 

Next, we consider the second channel component terms. Let on = p{q2i), Pj.i = p{v2j\q2i), P{X2 = 0|V2 = 
^2j} = /Uj , and P{V2 = W2j} = i^j, then 

I{V2;Yi2\Q2) = X a.ff X ^^.'(1 - /^j) - E (1 - /^j)) ■ 

This implies that 

/(V^2; yi2|Q2) - 1{V2\ Z2\Q2) = ^ E ( E E /^^■■'(i ~^'A-\ll (-"J' (1 - ^^)) ■ 

Comparing the above expressions, we see that /(V2; ^2|Q2) = implies that /(V2; Yi2\Q2) — I{V2\ ^2|Q2) = 0. 
This, together with (20), implies that i?cK is strictly less than 5/6. 

In comparison, consider the new lower bound in Corollary 1. Setting V ~ Xi and Xi and X2 independent 
Bernoulli 1/2, we have 

/(Xi, X2; Fii, ri2) - /(Xi, X2; Zi, Z2) = /(Xi; yn) - I(Xi- Zi) + /(X2; yi2) - /(X2; Z2) 

_ 1 1 _ 5 
" 3 ^ 2 " 6' 
I{V: Y2) - I{V; Z) = I{Xi;Y2i) - IiX,;Zi, Z2) 

= I{Xi;Y2i)-I{XuZi)^^. 

6 
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Thus, i? = 5/6 is achievable using the new scheme, which shows that the our lower bound can be strictly larger 
than the extended Csiszar and Korner lower bound. In fact, R = 5/6 is the capacity for this example since the 
channel is a special case of the reversely degraded broadcast channel considered in [5] and we can use the converse 
result therein to show that Cs < 5/6. 

Appendix III 
Proof of Theorem 2 

Using Fourier-Motzkin elimination on the rate constraints gives the following region. 

Ro<I{U;Z), 

R, < mm{I{Vo,V,;Y,\U) - I{V,;Z\Vo),I{Vo,V2;Y2\U) - I{V2;Z\Vo)}, 
2Ri < IiVo,Vi;Yi\U) + I{Vo,V2]Y2\U) - IiVi;V2\Vo), (21) 
Ro + Ri< min{/(l/o, Vi;Y,) ~ I{Vi; Z\Vn), I{Vo, V^2; >2) - I{V2; Z\Vo)}, 
Ro + 2i?i < I{Vo, Vi;Y,)+ I{Vo, ^2; Fa 1(7) - I{Vi; V2\Vo), (22) 
Ro + 2Ri < I{Vo, V2;Y2)+ I{Vo, Vi;Yi\U) ^ I{Vi; V2\Vo), (23) 
2i?o + 2i?i < I{Vo, V,;Y,)+ I{Vo, V2;Y2) - I{Vu ¥2%), (24) 

Re Rlj 

R,<mm{I{Vo,Vi;Yi\U)-I{Vo,Vi;Z\U),I{Vo,V2;Y2\U)-I{Vo,V2;Z\U)}, 
2R, < I{Vo,Vi;Yi\U)+I{V„,V2;Y2\U)-I{Vi;V2\V„)-2I{Vo;Z\U), (25) 
Ro + Re< inm{I{Vo,Vi;Yi) - I{Vi, Va; Z\U), I{Vo, F2; Fa) ~ I{V2,Vo; Z\U)}, 
Ro + 2R, < I{Vo,Vi;Y,) + I{Vo, V2;Y2\U) - I{Vi;V2\Vo) - 21 {Vo; Z\U), 
Ro + 2R, < I{Vo,V2;Y2) + I{Vo, Vi;Yi\U) - I{Vi;V2\Vo) - 21 {Vq; Z\U), 
2Ro + 2i?e < I{Vo,Vi;Yi) + I{Vo, F2; ^2) - I{Vi; V2\Vo) ~ 21 {Vo; Z\U), (26) 

with the constraint of /(Vi, V2; Z\Vo) < /(Fi; Z\Vo)+I{V2; Z|Vb) V2|Vb) on the set of possible probability 

distributions. Due to this constraint, the numbered inequalities in the above region are redundant. 

We now complete the proof by using rate splitting. This is equivalent to letting Ri = i?", Rq = Rq + R[ in 
the above region and letting the new rates be i?Q for the common message and i?" = R[ + R'l^ for the private 
message. Using Fourier-Motzkin to eliminate the auxiliary rates R'^ and R'( then results in the following region. 

Ro<I{U-Z), 

Ro + Ri< I{U- Z) + min{/(yo, ^1; Fi|C/) - /(Fi; Z\Vo), /(Fq, F2; ^2 - I{V2\ Z\Vo)}, 
Rq+Ri< mm{I{Vo,Vi;Yi) ~ I{Vi;Z\Vo),I{Vo,V2;Y2) ~ I{V2;Z\Vo)}, 

i?p < Ri, 

R, < mm{I{Vo ,Vi;Y,\U) ~ I{Vo,Vi; Z\U), I{Vo,V2;Y2\U) ^ I{Vo,V2; Z\U)}, 
Ro + Re< mm{I{Vo,Vi;Y,) - I{Vi, Vo; Z\U), I{Vo, ^^2:^2) - I{V2,Vo; Z\U)}, 
Ro + 2R,<I{Vo,Vi;Y,)+I{Vo,V2;Y2\U)~I{Vi;V2\Vo)-2I{Vo;Z\U), 
Ro + 2Re < I{Vo,V2;Y2) + I{Vo,Vi;Yi\U) - I{Vi;V2\Vo) - 2I{Vo; Z\U), 

Ro + Ri+Re< mm{I{Vo,Vi;Y,\U) - I{Vi; Z\Vo), I{Vo,V2; Y2\U) - I{V2; Z\Vo)} 

+ min{/(K,, Vi; Fi) - I{Vi,Vo; Z\U), I{Vo, ^2; F2) - /(^2, ^0; Z\U)}, 
R0 + R1+ 2R, < mm{I{Vo,Vi;Y,\U) ~ I{Vi; Z\Vo), I{Vo, V2; Y2\U) - /(F2; Z\Vo)} 
+ I{Vo,V,;Y,) + liVo, V2;Y2\U)- /(Fi; ^21^0) - 21 (Vo; Z\U), 
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Ro + Ri + 2R, < mm{I{Vo,Vi;Yi\U) - I{VuZ\Vo), I{Vo, t^a; F2IC/) - I{V2;Z\Vo)} 
+ I{Vo,V2;Y2) + I{Vo,Vi-Yi\U) ~ I{Vi;V2\Vo) ^ 2I{Vo; Z\U). 

Eliminating redundant inequalities then results in 

Ro<IiU;Z), 

Ro + Ri< HU; Z) + min{/(yo, Vi;Yi\U) - I{Vv,Z\V^)J{Vo,V2; Y2\U) - 7(^2; Z\Vo)), 
Ro + Ri< min{/(l/o, Vi;Yi) - I{Vi; Z\Vo), I{Vo,V2;Y2) - /(I/2; Z\Vo)}, 

i?e < Ri, 

i?e < mm{I{Vo ,Vi;Y,\U) ~ I{Vo,Vi;Z\U),I{Vo,V2;Y2\U) ^ I{Vo,V2;Z\U)}, 
Ro + Re < mm{I{Vo ,Vi;Y,) ^ I{Vi,Vo; Z\U), I{Vo,V2;Y2) - I{V2,Vo; Z\U)}, 
Ro + 2i?e < I{Vo,Vi;Yi) + I{Vo,V2;Y2\U) - I{Vi;V2\Vo) - 21 {Vq; Z\U), 
i?o + 2Re < I{Vo,V2;Y2) + I{Vo,Vi;Yi\U) - I{Vi;V2\Vo) - 2I{Vo;Z\U), 

R0 + R1+ 2R, < I{Vo,V2]Y2\U) ~ IiV2; Z\Vo) + I{Vo, Vi^Yi) 

+ I{Vo,V2;Y2\U)-I{Vi;V2\Vo)-2I{Vo;Z\U), 

R0 + R1+ 2i?e < I{V„,Vi;Yi\U) -I{Vi;Z\Vo) + I{Vo, ^2:^2) 

+ I{Vo,Vi; Yi I U) -I{Vi; V2 \ Vo) ~ 2I{Vo; Z\U). 



Appendix IV 
Converse for Proposition 2 

The i?i inequalities follow from a technique used in [8, Proposition 11]. We provide the proof here for 
completeness. 

nRi < I{Mi]Yu\Mo, Yi%i) + ne„ 

i 

< J2 I{Mi;Yu\Mo, Fi^i, Z'-i) + ^ I{Z'^-';Yu\Mo, Y,%,) + ne„ 

i i 

< i{m,,y;]^^,;Yu\Mo, z'-') - Y Hy^,^+l■,yM, z'-') 

i i 
i 

< ^/(X,;rH|Mo,Z'-i)+ne„ =^/(X,;ri,|C/,)+ne„, 

i i 

where (a) follows by the Csiszar sum lemma; and [h] follows by the assumption that Yi is less noisy than Z and 
the data processing inequality. The other inequality involving Y2 and Z can be shown in a similar fashion. 

We now turn to the R,, inequalities. The fact that R,, < Ri is trivial. We show the other 2 inequalities. We have 

ni?e < IiMi;Y^\Mo) ~ I (Mi; Z"|A/o) + ne„ 

n 

= J2 {l{MuYu\Mo, - I{Mi;Z,\Mo, Z'-')) + ne„ 



i=l 
n 

(a) 



Y {l{Mi,Z''-^;Yu\Mo, Y,^^^^,) ~ I{M,,Y,%,- Z,\Mo, Z'-')) + ne. 



i=l 
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1=1 

(c) " 

< ^ (/(Ml, Fi^i; FnlMo, Z^-^) - /(Mi, F/^+i; Z,|A/o, Z'-')) + ne„ 
1=1 

-A 

< ^ (/(X,; Fnlf/,) - /(X,; Z,|(7,0) + ne„, 

i=l 

where (a) and (6) follow by the Csiszar sum lemma; (c) follows by the less noisy assumption; (d) follows by the 
less noisy assumption and the fact that conditioned on (Mq, Z''^^), {Mi,Y^'^j^) Xi ^ {Yn^Zi). The second 
inequality involving I{X] Y2\U) — I{X; Z\U) can be proved in a similar manner Finally, applying the independent 
randomization variable Q ~ U[\ : n], i.e. uniformly distributed over [1 : n], and defining U = {Uq, Q), X — Xq, 
Yi = YiQ, Y2 = Y2Q and Z = Zq then completes the proof. 

Appendix V 
Proof of Proposition 3 

In cases two to four, the codebook generation, encoding and decoding procedures are the same as Case 1, but 
with different rate definitions. We therefore do not repeat these steps here. 

Case 2: Assume that /([/g; Z:i)-R^-I{Uz; Z2\U) > 0, IiV;Yi\U3)-I{V; Z2IC/3) < HV; Yi\U3)~IiV; Zsps) 
and i?e3 < IiV;Yi\U3)-I{V;Z2\U3). 

In this case, using the definitions of the split message and randomization rates as in case 1, we see that we 
can achieve Res = I{V; Yipa) - !{¥; Z2IC/3) by defining = I{V; Yipa) - I{V; Z2IL/3) and i?i'i = 0. The 
equivocation rate constraints now are 

R1o + R:> I{U3;Z2\U), 
R[ + R°,> IiV;Z2\U3). 

Performing Fourier-Motzkin elimination as before then yields the rate-equivocation region given in Case 2. 

Cfl^e 5: Assume that /(C/3; Z3)-/?o-/(C/3; ^2|C/) > 0, /(I/; yi|[/3)-/(l/; Z2IC/3) > /(-t^; Yi|C/3)-/(1/; Z3|(73) 
In this case, since we consider only the case of Ri > I{V; YilU^) — /(V; Z3IC/3), an equivocation rate of Rps = 
I{V;Yi\U3) - I{V; ZalUs) can be achieved by setting R[^ = Ky^Yipa) - I{V; Z^lUa). The constraints for this 
case are as follow. 

Decoding Constraints: 

Ro + RiQ + Rq + /?io < liUs] Z3), 

Rlo + R°io + R'o<nU3;Yi\U), 
/?'ii + i?'i'i + /?Ji + /?^ < liV; YilUs). 

Equivocation rate constraints: 

R1^ + R:> I{U3;Z2\U), 
R'{,+R[ + R1,> I{V;Z3\U3), 
Rl + R°^> I{V;Z2\U3). 

Greater than or equal to zero constraints: 

^(■10: rC^, K^l, K^l, Hi, > U. 

Equality constraints: 

Rl = Rio + ^10 + R'll + ^11 + ^11; 
Re2 = Rio + ^'11 + ^11 1 
Re3 = ^117 
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= /(y;Yi|[/3)-/(y;Z3|C/3). 

Performing Fourier-Motzkin elimination then results in the rate-equivocation region for Case 3. 
Case 4: Assume that liUs^Z^) - Rq - I{U3; Z2\U) < 0. In this case, note that i?e2 < min{i?i, Fi iJ/a) - 
I{V; Z2\U3)} and can be achieved using only the layer of codewords. We set R^q = in this case. If 

IiV;Yi\U3) - I{V-Z2\U-i) < I{V-Yi\Uz) - liV-Z^p^), then i?e2 = I{V-Yi\Uz) - I{V;Z2\U3) and i?e3 = 
min{i?i, /(F; Yips) - I{V; Z3IC/3)} are achievable. If I{V; Yi\U3) - I{V- Z2IC/3) > /(F; Yips) - I{V] Zaps), 
then Re3 = I(y;Yi\U3) - I{V; ZslUa) and i?e2 = min{i?i, /(y; F1IC/3) - /(X^; Z2IC/3)} are achievable. 

Appendix VI 
Proof of Proposition 4 

As in [8], we establish bounds for the channel from X to {Yi, Z2) and for the channel from X to (Yi, Z3). 
The X to {Yi,Z2) bound: We first prove bounds on Rq and Define the auxiliary random variables Ui = 
{Mo, Yi*"i), U3^ = (Mo, ^3".+i)' and = (Mi, Mo, Zl,+,,Y^-^) for i = 1, 2, . . . , n. Then, following the 

steps of the converse proof in [16], it is straightforward to show that 



1 " 

Ro < - V/(C/^;^2«) + e„, 
n ^ — ' 

1=1 

1 " 

Ri <-y^{I{V^;Yu\U,)) + er, 

n ^ — ^ 



n 
i=i 



where e„ — > with n. 

To bound Re2, first consider 

H{Mi\Z^) < H{Ah\Z'^,Ma) + ne„ 



H{Ah) - /(A/i; Z^'lMo) + ne„ 
< /(Mi; ri"|Mo) - /(Mi; Z^'|Mo) + ne. 



^(/(A/i; ri,|A/o,yr') - /(Mi; Z2,|Mo, Z^')) 

id) 



i=l 
n 

< Y,{HX^;Yu\Mo, Y^-^) - I{X,; Z2MI0, Z^^)) + ne„ 
1=1 

n 

= Y,iIiX^■,Yu\Ui) - //(Z2.IM0, Zr') + //(; ^2.|Mo, ^0) + nen 
1=1 

(e) " 

< Y.iIiXf,Yu\U,)-H{Z2MIa,Zl\Y'-') + H{Z2,\Mo,Zi-\Y'-\Xi)) + ner. 



n 

Y,iIiX^■,yl^\U^)~I{X,■,Z2^m)+nen, 
i=l 

where (a) and (c) follow by Fano's inequality, (&) follows by the independence of Mi and Mq. (d), (e) and (/) 
follows by degradation of the channel from X Yi Z2, which implies ^2^ — > Y^^^ — !> — !> Yu Z2i 
by physical degradedness. For the next inequality, we use the fact that a stochastic encoder p(a;"|Mo, Mi) can be 
treated as a deterministic mapping of (Mo, Mi) and an independent randomization variable W onto X". 



nRo + nR,2 = H{Mo) + H{Mi\Z^) 

< H{Mo) + H{Mi\Z^, Mo) + ncn 
/(A/o; Z^) + H{Mi\Mo) - H{Mi\Mq) + H{Mi\Z^, Mq) + ne„ 
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= /(A/o; Z3") + /(Mi; yi"|Afo) - I{Mi;Z^\Mo) + ne„ 

(b) 

< /(A/o; ^^') + /(A/i, W^; ri"|A/o) - /(A/i, W^; Z2"|A/o) + 7ie„ 

(c) 

< I](^(C^3.; Z3^) + /(X,; FhIC/s,)) - /(A/i, W^; Z^\Mo) + ne„ 

i=l 



< 5](/(f/3.; ^3.) + /(X,; FhIc/s,)) ~ J2 ^(^2.|A/o, 

n 

+ H{Z2,\Mi,Mo, W, Zr') + ne„ 

i=l 

n n 

5^(/(c/3.; ^3.) + i{Xf,Yu\U3,)) - H{Z2Mio, yr^) 

n 

+ J2 H{Z2M'h,Mo, W, Y^-^) + 7ie„ 

i=l 

n n 

= ^(/(C/3^; ^3*) + /(X,; yi,|i73,)) - Y ^(^'^1' ^'^0; ^2.|Mo, rr^) + 7M„ 

n n 

YiI(.U3^; Z^,) + I{X,-Yu\U^,)) - Y Z2,|A/o, Y^-^) + ne„ 

1=1 i=l 
n n 

= 5Z(/(C/3.; ^3») + I{X,;Yu\U3,)) - ^ /(X,; Z2^\U^) + ne„, 
'i=i 1=1 

where (a) follows by Fano's inequality and //(A/qIZj ) < ne„; (b) follows by degradation of the channel from 
X — > {Yi,Z2)', (c) by Csiszar sum applied to the first two terms (see for e.g. [2]); (d) follows by the fact that 



conditioning reduces entropy; (e) follows by the Markov relation: Zi, 



Y' 



{Mo,Mi,W) ^ Z2^■, (f) 



follows by the fact that Xi if a function of (A/q, Mi, W). This chain of inequalities implies that 

-j^ ?i 1 

i?e2 < - y (/(%»; Z3^) - /(C/3.; Z2^\U^)) - Rq + - V(/(X,; Yu\U3^) - I {X^; Z2^\U3^)) + 



< 



- ^(^(^3*; ^3») - ^(C^3«; ^2»|[/.0) - i?o + - V(/(X,; yH|[/30 - /(X,; Z2.IC/3.)) + 



Finally, we arrive at single letter expressions by introducing the time-sharing random variable Q ^ U[l : n], i.e. 
uniformly distributed over [1 : n], independent of {Mq, Mi, X,Yi, Z2, Z3,W), and defining Uq = {Mo,Y^~'), 
U ^ {Uq,Q), Vq = {Ml, U, ^a.Q+i)' ^1 ^ YiQ and Z2 = Z2Q to obtain the following bounds 

Rn<I{U;Z2) + e„, 
Ri < I{V;Yi\U) + Cn, 
Re2 < {I{X;Yi\U)-I{X;Z2\U))+en, 

Re2 < [/(C/3; Z3) -Ro- I{U3; Z2\U)]+ + I{X; Yi\U3) - I{X; Z2\U3) + £„. 

The X {Yi,Z3) bound: The inequalities involving X (11,^3) follow standard converse techniques. First, 
applying the proof techniques from [15], we obtain the following bounds for the rates 



f 1 " 1 " 1 

i?o <min<^ - Y I{U3^■, Z3^), -Yl{U3^;Yu) \+e„, 

K i=l 4=1 ) 

1 " 

R<i+Rl < - y{I{V,;Yu\U3^) + I{U3^; Z3r)) + Cn. 
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We now turn to the second secrecy bound, 

H{Ah\Zr^) < H{A'h,Mo\Zl') = H{A'h\ZS,Mo) + H{Mo\ZS) 

< H{Ah\ZS,Mo)+nen 
(&) 

< H{M,\Zl\Mo) - H{M^\Y{^,Mo)+nen 
= /(Mi; yi"|Mo) - /(Mi; Z^\Mo) + ne„, 

where (a) and {b) follow by Fano's inequality. Using the Csiszar sum lemma, we can obtain the following 



H{M,\Z^) < Y,iI{MuYu\Mo,Y^-')-I{MuZ3,\Mo,Zl,+,))+ne^ 

n 

J2iIiMi,Zl,^,;Yu\Mo, Y^-^) - I{M,,Yr'; Z^^Io, Zl,+,)) + ne„ 

n 

^'^ ^(/(Mi; yi,|A/o, YI-\Zl,^,) - /(Mi; Z3.IA/0, ^3".+!- n'"')) + 

n 

= Y,{IiV^■,Yu\U3^) - I{V^;Z3,\U3^)) + ne„, 

where both (a) and (b) are obtained using the the Csiszar sum lemma. Applying the independent randomization 
variable Q ~ U[l : n], i.e. uniformly distributed over [1 : n], we obtain 

Ro < min{/([/3; Z3), /(C/3; Yi)} + e„, 
Ro + Ri<I(U3;Z3) + I{V-Yi\U3) + en, 
Re3<I(V;Yi\U3)-I{V;Zs\U3) + en, 

where U3Q = {Mo,Y^^^ , ZI'q_^_-^), U3 = {U3q,Q), Yi = Yiq and Z3 = Z3Q. This completes the proof of the 
outer bound. 
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